[kyle-sexton]

No related issue: release repin; the defect was reported by the Issue Triage session (example #9695)

Summary

Repins the intake triage caller to ci-workflows
v0.65.15
(30b251532b2e9f7e0c4215e1dee5be0d3c688743). That release keeps one priority: label per issue:
a priority a listed human set stays, and a bot-set one is replaced
(ci-workflows#896).

Fix

• Only .github/workflows/intake-triage.yml moves. Among the paths this repository pins, the
  v0.65.14..v0.65.15 compare changes only intake-triage.yml.
• The runner-policy contract for the new SHA is registered in
  standards#891 and synced here. Inputs,
  secrets, outputs and permissions are unchanged from v0.65.13; only one input description changed.

Verification

• node .github/standards/runner-policy/runner-policy.mjs --root .: passes.
• node --test .github/actions/resolve-config/callers.test.mjs: 183 pass, 0 fail.
• scripts/check-stale-base-overlap.sh --check origin/main and scripts/check-affected.sh --tests: pass.

Related

• melodic-software/ci-workflows#896
• melodic-software/standards#891

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T11:03:44.499592Z	09c23fe	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 09c23fe4c950abd08bf0f3c014d57c066f504fed: 0 finding(s), 0 as inline comments.

No security issues found.

The diff is one line: .github/workflows/intake-triage.yml:216 moves the pinned reusable workflow melodic-software/ci-workflows/.github/workflows/intake-triage.yml from ba7af78d… (v0.65.13) to 30b25153… (v0.65.15).

• Pin form: the new ref is still a full 40-character commit SHA, with the version in a trailing comment. The pin is not loosened.
• Callers: the with:, secrets: and permissions: blocks are untouched in this diff, so the caller grants the called workflow nothing new. I did not read the called workflow's code at the new SHA (no network access), so I did not check what it does with those grants.
• Runner policy: the same SHA is registered in .github/standards/runner-policy/policy.json:468, which agrees with the PR description's note that the contract was synced.
• Trust controls: the changed file is not one of the trust controls this lane tracks (trusted-trigger check, lane token scope, kill switch, token-broker rules, merge holds, pr-pipeline.yaml, CODEOWNERS, .gitmodules). Nothing in the diff widens who is trusted or what token scope is requested.
• Not verified: I could not confirm that the SHA matches the v0.65.15 tag. The PR text says the v0.65.14..v0.65.15 compare changes only intake-triage.yml, and I did not check that claim against the upstream repository. A person can confirm both from the release page.

manifest: not hit (no plugin manifest changed).
critical-findings: 0

Spend: no change to API-credit or subscription usage is visible in this diff.

[github-actions]

claude-review reviewed 09c23fe4c950abd08bf0f3c014d57c066f504fed: 0 finding(s), 0 as inline comments.

No findings. The PR changes one line, .github/workflows/intake-triage.yml:216. It moves the intake-triage reusable-workflow pin from ba7af78d… (v0.65.13) to 30b25153… (v0.65.15), and the version comment is updated to match.

• Runner-policy registration: I confirmed the new SHA appears in .github/standards/runner-policy/policy.json. The runner-policy check, which gates the pin, is therefore satisfied for this caller.
• Mixed pins: Other workflows (pr-verify.yml, pr-unblock.yml, pr-run-activity-*.yml) still pin ci-workflows actions at v0.65.13. The PR says only intake-triage.yml changed among the paths this repository pins, so this is deliberate.
• No inputs changed: The diff leaves the with: inputs, secrets and permissions as they were.
• Not verified: I could not check that the SHA matches the v0.65.15 tag, or the author's runner-policy and test results. They are author-claimed.
• PR context: There is no closing issue ("No related issue: release repin"), so there are no acceptance criteria to check. I found no embedded instructions in the PR text.
• Cost: No billing change. The pin only changes which triage logic runs.